Plenary session on the 
accident at Sayano Shushensk 


Summarized by J. Gummer, Session Chairman 


In view of the gravity of the accident at Sayano Shushenskya in Russia in August 2009, which involved 
considerable loss of life, it was decided by the organisers of HYDRO 2010 to hold a plenary session, with a 
special lecture by Dr E. Bellendir of the VNIIG Institute, St Petersburg, to discuss the causes of the accident 

and to obtain input from the industry as a whole on the implications of the accident on future design, 

operation and maintenance of similar hydro plants. 


presentation on the accident at the Sayano 

Shushenskaya plant in Russia, and two more 
succinct ones on related accidents and events. This 
was followed by a panel discussion with considerable 
input from floor. The panel consisted of Dr Evgeny 
Bellendir, John Gummer, Bryan Leyland and 
Professor Hermod Brekke. The session was co- 
chaired by Dr Bellendir and John Gummer. 

This paper summarizes the three presentations and 
the subsequent panel discussion. The summary of Dr 
Bellendir’s presentation on the Sayano Shushenskya 
accident is necessarily abridged here, and it is intend- 
ed that a more detailed paper will be presented by Dr 
Bellendir and his colleagues in a future edition of 
Hydropower & Dams. 

At the beginning of the plenary session a full and 
detailed account of the tragic accident at the Sayano 
Shushenskya powerplant in Russia was given by Dr 
Bellendir. 

This powerplant, in Khakassia, Siberia, was the 
world’s sixth largest. The powerhouse had ten 640 
MW Francis units producing 24 TWh/year, which met 
10 per cent of Siberian energy requirements. The plant 
is on the Yenisei river, and the 245 m-high dam 
stretches | km across the river. The powerhouse is at 
the toe of the dam, and the gated spillway is on the 
right side dam crest. The turbines were designed for a 
rated head of 194 m, and a rated speed of 143 rpm, and 
the 16 blade Francis runners have an exit diameter of 
6.8 m. Guidevane actuation was by individual servo- 
motors and turbine isolation was by means of intake 
gates, there being no turbine inlet valve. Each turbine 
was supplied by a dedicated relatively short penstock, 
flush with the dam’s downstream contour. 

The first unit began operation in December 1978 and 
the 10th and last unit came on line in December 1985. 
Between 2007 and 2011, the plant was modernized 
and refurbished, during which time controls and pro- 
tection systems were replaced and a comprehensive 
distributed control system (DCS) was installed. 


Te plenary session was in the form of one major 
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The accident occurred on 17 August 2009 at 08.13 
hrs. It was preceded by a fire in a communication room 
at the nearby Bratsk hydro plant, which resulted in an 
order to the operators at Sayano Shushensk to use the 
station for regulation of the electrical grid. Unit 2 was 
selected as the lead unit for regulation, as it was regard- 
ed as the most reliable of the 10 units after its recent 
maintenance. Units 8 and 10 were operating as base 
load, Unit 6 was undergoing maintenance and the other 
six units were following frequency at a higher perma- 
nent droop than Unit 2. All the units suffer from sub- 
stantial draft tube pressure pulsations and associated 
high vibrations when generating at part load. 
Vibrations are particularly bad for operation between 
250 and 450 MW and consequently the units were nor- 
mally operated outside of this critical zone. 

In its enforced frequency control mode on 17 August 
2009, Unit 2 entered the critical zone many times, 
resulting in considerable vibrations in the unit. 
According to Dr Bellendir, this type of forced opera- 
tion in the unstable zones had occurred many times 
during the life of the units. 

Unit 2 was equipped with vibration monitoring 
equipment, which had been installed in 2009 during 
rehabilitation, but unfortutely this equipment was out 
of service and accordingly considerations and mitiga- 
tion of high vibration were not part of the operational 





HYDRO 


Dr E. Bellendir of the 
VNIIG Institute, St 
Petersburg, gives full 
details of the accident 
at Sayano Shushensk, 
during the special 
plenary session in 
Lisbon. He was warmly 
applauded for sharing 
this detailed 
information with the 
international 
hydropower 
community, so 
constructive lessons 
could be learnt from 
this tragedy. 


The panel, during 
discussions on 
lessons learned from 
the accident at 
Sayano Shushensk. 
John Gummer 
chaired the debate. 


Far left: participants 
at the special 
plenary session. 
Nearly 600 
delegates attended, 


51 


E 
a 
i a 
F 
= | 
“l 
ifs 
ti 


ii 
5 


Above left and 
centre: the Sayano 
Shushenskaya 
powerhouse before 
and after the 
accident. 


Far right: Unit two, 
weighing more than 
1600 tonne, lifts into 
the air, as the 
accident occurs. 


Prof Hermod Brekke 
of Norway offers his 
comments and 
recommendations, 
and tells of an 
accident at a Kaplan 
powerplant in 
Norway. 
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decisions at the despatch centre. Without doubt, at the 
time of the accident, head cover and draft tube vibra- 
tions were considerably higher than values typically 
considered acceptable for similar hydro units. 

At 08.13 hrs, the head cover of Unit 2 broke away 
from its restraints. The generator at Sayano Shushensk 
is mounted on a thrust bearing cone supported on the 
head cover, and the hydrostatic force under the now 
free head cover was sufficient to lift the total 1600 
tonnes of rotating parts and thrust bearing support 
cone into the air. Penstock water poured into the now 
open turbine, flooding the station and causing consid- 
erable damage to the other units and to the station ser- 
vices. A transformer exploded, all control to other 
units was lost and part of the powerhouse roof col- 
lapsed. The end result was the complete destruction of 
Units 2, 7 and 9 and partial destruction of Units 3, 4 
and 5. 

Dr Bellendir explained that many reasons, including 
adverse hydraulic transients, higher than design stress- 
es caused by extreme electrical forces, terrorist action, 
and mechanical failures were considered by the inves- 
tigating body, but eventually the problem was attrib- 
uted to failure of the turbine head cover holding bolts 
which had corroded, loosened and fatigued. Nuts were 
shown to be missing from six bolts, and pictures were 
shown of the bolts which had obviously failed in 
fatigue before the accident. 

Repair and replacement of the affected units is now 
underway. The dam and its foundations were unaffect- 
ed. Currently Units 6, 5 and 4 are in operation. Dr 
Bellendir said, and Unit 3 will be on line by the end of 
this year. Six new units will be installed between 2011 
and 2014, and between 2013 and 2014 the repaired 
units will be removed and new ones installed. 

The problems in the powerhouse were exacerbated 
by subsequent failures in the dam water control sys- 
tems. These were: the inability to close the intake 
gates fast and automatically; difficulty in opening the 
spillway gates; and, failure of the powerhouse 
drainage pumping system. The reason for the prob- 
lems with the gates was the complete loss of auxiliary 
electrical supplies and controls. The pumping system 
failed because the pumps were not equipped with sub- 
mersible motors. 


Key recommendations 


Dr Bellendir recommended that: all power intakes 
should be automatic and fast closing (maximum 
closure time of 2 minutes); standby facilities should 
be available to open spillway gates; all station 
pumping systems should employ submersible 
pumps; turbines should not be permitted to run in 
very rough running regimes; equipment should be 
regularly inspected for failure and cracks; and, the 
number of personnel in potential flood zones 
should be minimal. 





Panel Comments 


Dr Bellendir’s presentation was followed by an 
account by Bryan Leyand of a similar accident in 
Canada. In this case, the four Kaplan units had been 
more than 40 years old, and two of them had been 
used extensively for frequency regulation which had 
resulted in serious hunting to the extent of almost 
complete closure of the guidevanes on each cycle. 
Essentially, this had been equivalent to multiple start 
stops, which had eventually resulted in failure of the 
head cover bolts and flooding of the station, fortu- 
nately in this case with no loss of life. 

Bryan Leyland deplored the industry’s lack of 
openness in the case of the Canadian accident, 
which had never been reported or publicly record- 
ed. Had it been reported, then probably there may 
have been a general inspection of head cover bolts 
worldwide, and the accident at Sayano Shushensk 
could have been avoided. In constrast, Leyland 
applauded the Russian authorities in their open- 
ness in making public the details of the Sayano 
Shushenskaya powerplant accident, a sentiment 
audibly shared by all session participants. 

Professor Brekke followed with a short description 
ofan accident at a Kaplan powerplant in Norway. This 
had been caused by the failure of bolts in the runner 
envelope. These had fatigued as a result of pressure 
pulsations generated by the passing runner blades. 
Professor Brekke emphasized that any bolt load is 
only taken by about three threads and the stresses 
in these three threads almost reach the yield 
strength of the material. When superimposed on 
such a high stress, any additional dynamic loading 
on the bolt can be instrumental in promoting 
fatigue. Such bolt fatigue is exacerbated by the 
stress concentration in the sharp edged thread and 
the adverse effects of corrosion on local material 
properties. Some mitigation can be obtained by 
increasing the length of the bolts but the only sure 
solution is regular inspection and bolt substitution, 
if found by the inspection to be necessary. 
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Chairman’s comments and discussion 


A lively and interesting open discussion followed 
which, under the guidance of the co-chairman John 
Gummer, concentrated on the following aspects high- 
lighted by the accident at Sayano Shushensk: 


e design to minimize vibrations 
machines; 

e design of hydro units to minimize the possibility of 
catastrophic accidents; 

e quality Assurance during design, manufacture and 
erection; 

e monitoring of operation to identify potential prob- 
lems; and, 

e maintenance procedures to ensure long term acci- 
dent free operation. 


in hydraulic 


In his introductory remarks Gummer commented 
on the problems inherent in ISO 10816-5, the stan- 
dard which covers permissible vibrations in 
hydraulic machines. Although limits on the x and y 
vibrational amplitudes are covered by the code, 
regrettably it is silent in respect of axial vibrations (z 
direction). Gummer felt that this needed to be 
addressed as z direction vibrations were extremely 
critical, as evident in the Sayano Shushensk accident. 

Gummer also queried whether isolating devices 
such as inlet valves or ring gates should be provid- 
ed at the turbine inlet, even for large units such as 
those at Sayano Shushensk. Typically for units with 
a single relatively short dedicated penstock, tur- 
bine inlet valves were not provided and automatic 
closing of the intake gate was relied upon to protect 
the unit, he said. 

Gummer reflected on the accident at the Dartmouth 
hydropower station in Australia, which had suffered a 
guidevane cascade failure resulting from a steel beam 
imprisoned in the runner. Although the pressure rise 
resulting from the cascade failure had broken the spi- 
ral case, the extent of flooding had been mitigated 
because the turbine inlet valve had successfully 
closed. 
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With respect to maintenance, Gummer raised the 
question of how often full maintenance requiring 
complete dismantling of a large unit should be con- 
ducted. A period of every seven years, as recommend- 
ed by one manufacturer, was obviously too short, he 
felt, whereas 30 years may be too long. 

With these introductory remarks Gummer opened 
the discussion to the floor. 

The procedures in evaluating accidents and failures 
were questioned by one participant. The participant 
drew on his experience in the aerospace industry, 
where the first measure, he said, was correction of the 
immediate defect, the second an immediate search for 
similar errors and elimination of same, and the third, a 
full investigation into existing processes to ensure that 
such errors could never re-occur. 

As all three accidents reported by the speakers had 
occurred as a result of failure of securing bolts, one 
participant highlighted the critical aspect of informed 
and ongoing co-ordination between equipment and 
civil designers. He rightly stated that it is essential for 
correct design information on both static and dynamic 
loadings to be passed to the civil designer, to ensure 
that loads originating in equipment were properly 
accommodated in the civil works. 

With respect to component life and maintenance 
procedures, Prof. Brekke made the all important 
comment that with deregulation and the increasing 
amount of intermittent wind and solar power on 
electrical systems, many hydro units were being 
operated in a manner completely different to that 
for which they had been designed. As opposed to 
base load generators, hydro units were increasing- 
ly called upon to perform multiple start stops, to 
change load rapidly to regulate system frequency 
and, as a result, to operate in regions of high vibra- 
tion. Accordingly a far more intensive inspection 
regime was required now than adopted previously. 
Welds of stayvanes, runners, spiral casings, brackets 
rotor structures and base plates and holding bolts 
should be non-destructively tested annually, he said. 
This was particularly important for newer units in 
which stresses were typically higher than in older 
ones, he added. 

The frequency of dismantling for a complete over- 
haul should be guided by the results of these inspec- 
tions. If many cracks are found, then the frequency of 
overhaul should be increased. 

According to Prof. Brekke, if no cracks are found 
after 100 million cycles of operation, then one could 
rest at night. If cracks were frequently found and had 
to be repaired during annual inspections then addi- 
tional vigilance, possibly involving complete disman- 
tling, would be required. 

The changing role of hydro and need for regular 
inspection was reinforced by a comment from the 
floor. According to a representative from Andritz 





Far left: The Sayano 
Shushensk dam, 


which did not 


sustain damage. 


Left: Close up view 
of Unit 2, 
immediately after 


the accident. 


Bryan Leyland of 


New Zealand 


described a similar 
accident which had 
occurred in Canada, 
and deplored the 
fact that details had 
not been made 
available to others 


in the hydro 


industry. 
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Hydro, in respect of the fatigue life of some turbine 
generator components, one start up is equal to a year’s 
operation at best efficiency. This makes regular 
inspection for cracks and component failure impera- 
tive. Professor Brekke emphasized the need for only 
skilled personnel to be employed in inspections for 
cracks in hydro components. Equally important is the 
use of trained professionals in the interpretation of the 
results of such inspections and in deciding on neces- 
sary corrective measures, if any, he said. 

There was general agreement that operation of equip- 
ment needs to be trended using data from the monitor- 
ing systems which are now almost standard in new 
important plants. The general consensus was that there 
is no point in having the monitoring if the resulting 
records are never properly analysed. There was also 
the suggestion that the state of electrical and mechani- 
cal equipment at hydro plants should be periodically 
audited by an outside body, similar to the now common 
practice of the auditing of hydro civil structures. 

There was a call from one participant for compre- 
hensive risk assessment and the equally important but 
more embracing procedures of asset management for 
hydro plants. Risk assessment and asset management 
are now extensively used in other industries such as 
oil and gas, and nuclear. Preventative maintenance can 
be expeditiously managed with risk assessment and 
needless expensive replacement of parts which have 
been allowed to deteriorate beyond the state of eco- 
nomic repair can be avoided by adopting appropriate 
trending procedures. Risk assessment and asset man- 
agement are particularly relevant for units used for the 
demanding role of electrical system stability. 

The panel was questioned on the merits of continuous 
vibration monitoring of hydro units, and the value of 
fatigue analysis of major component parts of the unit. 
Gummer pointed out that continuous vibration moni- 
toring was used extensively on new important units, 
and was an integral part of the majority of equipment 
specifications. Typically monitored were all bearings, 
generator brackets, turbine head covers and, in some 
instances, draft tubes cones. Tri-axial vibration trans- 
ducers were available, or a transducer could be provid- 
ed for each of the three directions. Gummer again 
bemoaned the absence of a standard which covered 
limits for vertical vibrations in hydro units. 

Gummer reported that fatigue analysis of important 
new units was commonly requested by specification 
and even when it was not, traditionally a manufacturer 
would conduct this as a matter of course. It was unre- 
alistic and unnecessary to request fatigue calculations 
for smaller units and in these cases the experience of 
the manufacturer and past precedence should be relied 
upon, he said. The theoretical basis for fatigue analysis 
was well established, and the results obtained were 
reliable. 

The need for detailed and comprehensive operation 
and maintenance manuals was highlighted by one par- 
ticipant. He rightly stated that many O&M manuals 
were incomplete or incomprehensible, which could 
only result in questionable practices over the years of 
operation of a typical hydro plant. At the start of any 
project, all manuals, drawings and data should be vet- 
ted for completeness and substance, and should be 
kept up to date as equipment changed or was modi- 
fied. Similarly, staff should be adequately trained and 
the operating body should hold ongoing training ses- 
sions to cover all conceivable operating emergencies. 
Emergency measures should be well rehearsed and all 
operating staff should be aware of exit procedures. 


In the context of training, operation and the changing 
roles of hydro, there was a call for better co-ordination 
between system controllers and power station staff. 
Controllers should be aware of the limits of the equip- 
ment which they are called upon to operate and that 
the safety of equipment and operation is paramount. 
Power station staff should therefore have as much 
authority as system controllers in determining any 
operating regime, and should have the right to refuse 
a command if it puts the generating equipment in jeop- 
ardy. There should be an overriding governing body 
which co-ordinates the various roles and gives priori- 
ty to the appropriate organization. It is acknowledged 
that the exigencies of energy supply in a deregulated 
system are strong and without such established proce- 
dures and priorities accidents such as occurred at 
Sayano Shushensk are all too possible. The example 
of a small dam in Kazakhstan was mentioned, where 
commercial demands had taken precedence over safe- 
ty, with unfortunate results. 


Conclusions 


Several notable conclusions can be drawn from the 
description of the accident at the Sayano 
Shushenskaya powerplant accident, and the subse- 
quent panel discussions and comments from the floor. 
The first concerns the effect of deregulation and the 
increasing amount of unpredictable and intermittent 
wind and solar power in an integrated electrical sup- 
ply system, both of which are rapidly changing the 
operating mode of hydro. 

Whereas in the past, hydro was typically a base load 
provider, increasingly it is being used for system reg- 
ulation and system backup, and as such is encounter- 
ing multiple start stops, and a propensity for far high- 
er flow-induced vibrations in operation, leading to 
premature component failure symptomatic of the acci- 
dent at Sayano Shushensk. Accordingly, at today’s 
hydro plants, greater inspection for component failure 
is required, together with far more advanced monitor- 
ing systems, coupled with proper risk assessment to 
guide maintenance procedures. 

In the same vein, safety of operation should always 
take precedence over the demands of operation, and 
there should be strict regulations in force to ensure 
that this is the case. 

The Sayano Shushenskaya powerplant accident also 
clearly demonstrated the need for automatic failsafe 
closure of intake gates, such as locally controlled grav- 
ity closure, independent of any auxiliary electrical sup- 
plies. There should also be a local means to open spill- 
way gates, completely independently of the electrical 
services supplies. These could be diesel-driven opera- 
tors, in the case of winched actuated gates, or a diesel- 
driven pumping set for hydraulic actuated gates. 

Operation and maintenance requirements must be 
well documented, and personnel properly trained to 
implement the correct procedures, especially those 
dealing with any conceivable emergency. There could 
well be a case for external audits of hydro mechanical 
and electrical equipment and procedures similar to the 
audits traditionally conducted on hydro civil structures. 

Great appreciation was expressed to Dr Bellendir, for 
his full and frank account of the tragic accident, and it 
was agreed that the sharing of such information among 
colleagues in the profession was extremely valuable in 
preventing future incidents of this kind. The speed with 
which Russian engineers had researched the causes of 
the accident, and also made significant progress with 
remedial work at the site, was also commended. Q 
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